According to The Record, Electronic Arts Sports (EA) was the victim of a cyber hacking in June, when hackers posted on an underground hacking forum that they were in possession of EA data seeking a sale price of $28 million. The hackers were reportedly able to access EA’s system after purchasing tools that allowed authentication into an internal Slack communication thread from a dark web marketplace and mimicking a legitimate employee user’s account.
The hackers were then able to download a large amount of source code from the company with the hope of selling it for big money. Unfortunately, they were unable to find a buyer, so they went back to EA asking for payment to prevent the data from being leaked publicly. The hackers released part of the cache of data to prove they had it and to put pressure on EA, allegedly including the source code for the FIFA 21 soccer game.
It has been reported that EA refused to pay the extortion amount, so the entire data set has been leaked online. EA has confirmed that no player data was involved and that it is actively assisting law enforcement with the investigation into the incident.
The incident illustrates how a legitimate internal communication tool can be used against a company through new tools purchased online that leverage employees’ passwords and the ability for hackers to escalate authentication protocols. It is important for employees to refrain from using passwords across different platforms since they are stolen and purchased online to use for nefarious purposes.